Examine data model or data model dataset and search a data model dataset.
datamodel command to return the JSON for all or a specified data model and its datasets. You can also search against the specified data model dataset.
A data model is a hierarchically-structured search-time mapping of semantic knowledge about one or more datasets. A data model encodes the domain knowledge necessary to build a variety of specialized searches of those datasets. These specialized searches are in turn used by the search to generate reports for Pivot users. For more information, see About data models and Design data models in the Knowledge Manager Manual.
datamodel search command lets you search existing data models and their datasets from the search interface.
datamodel command is a generating command and should be the first command in the search. Generating commands use a leading pipe character.
| datamodel [<data model name>] [<dataset name>] [<search>]
- data model name
- Syntax: <string>
- Description: The name of the data model to search. When only the data model is specified, the search returns the JSON for the single data model.
- dataset name
- Syntax: <string>
- Description: The name of a data model dataset to search. Must be specified after the data model name. The search returns the JSON for the single dataset.
- Syntax: <search>
- Description: Indicates to run the search associated with the specified data model and object. For more information, see the search command.
Generating commands use a leading pipe character and should be the first command in a search.
1. Return the JSON for all data models
Return JSON for all data models available in the current app context.
2. Return the JSON for a specific datamodel
Return JSON for the Splunk's Internal Audit Logs - SAMPLE data model, which has the model ID internal_audit_logs.
| datamodel internal_audit_logs
3. Return the JSON for a specific dataset
Return JSON for Buttercup Games's Client_errors dataset.
| datamodel Tutorial Client_errors
4. Run a search on a specific dataset
Run the search for Buttercup Games's Client_errors.
| datamodel Tutorial Client_errors search
5. Run a search a dataset for specific criteria
Search Buttercup Games's Client_errors dataset for 404 errors and count the number of events.
| datamodel Tutorial Client_errors search | search status=404 | stats count
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about using the datamodel command.
This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.3.0